Skip to content

Security Fail in Pokémon Go

By Jeff Williams, Co-Founder, Chief Technology Officer

July 14, 2016

Application Security

    
Pokemon_Go_Security_fail.jpg
 
As you may have heard, some Pokémon Go players may have given the game’s developers access to everything on their Google account – including documents, photos, email messages, search history and items stored their cloud.
 
According to NBC News, this is due to a coding glitch, causing iOS devices to give the app full access to the gamer’s account.
 
Pokemon_Go_Security_fail.jpg
This is pretty minor in the panoply of security glitches. Yes, the app requests more access than it needs, but Niantic has confirmed that they don't actually use their overzealous access rights.
 
We live in a world that doesn't allow granular control over our information.  Access control is one of the most complex security mechanisms and is often difficult to implement correctly.  
 
Actually Niantic deserves some credit for leveraging a strong proven authentication source instead of implementing their own.
 
A scarier thought is what someone like Mint could do with full access to everyone's bank accounts.  The fact is that we share far more access than we technically need to, trusting internet companies with not only information, but the capability to act on our behalf.
Application Security
Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast Security. He recently authored the DZone DevSecOps, IAST, and RASP refcards and speaks frequently at conferences including JavaOne (Java Rockstar), BlackHat, QCon, RSA, OWASP, Velocity, and PivotalOne. Jeff is also a founder and major contributor to OWASP, where he served as Global Chairman for 9 years, and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many more popular open source projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

Previous

Contrast releases new open source integrations to transform DevOps into DevSecOps
Next

The True Cost of "False Positives" in Application Security